From 56f887709751f4bb49e1d2b630fb2bb93cf8931c Mon Sep 17 00:00:00 2001
From: ejahnGithub <ejahngithub@github.com>
Date: Fri, 30 May 2025 13:31:23 -0700
Subject: [PATCH] update the artifact and bundle for testing

---
 pkg/cmd/attestation/artifact/file_test.go       |   2 +-
 .../test/data/github_release_artifact.zip       | Bin 797 -> 169 bytes
 .../data/github_release_artifact_invalid.zip    | Bin 427 -> 188 bytes
 .../test/data/github_release_bundle.json        |   6 +++---
 .../release/verify-asset/verify-asset_test.go   |  10 +++++-----
 pkg/cmd/release/verify/verify_test.go           |   2 +-
 6 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkg/cmd/attestation/artifact/file_test.go b/pkg/cmd/attestation/artifact/file_test.go
index ed9e7049a..54768e93e 100644
--- a/pkg/cmd/attestation/artifact/file_test.go
+++ b/pkg/cmd/attestation/artifact/file_test.go
@@ -12,7 +12,7 @@ func Test_digestLocalFileArtifact_withRealZip(t *testing.T) {
 	artifactPath := test.NormalizeRelativePath("../../attestation/test/data/github_release_artifact.zip")
 
 	// Calculate expected digest using the same algorithm as the function under test
-	expectedDigest := "f7165848f9f5ddc578d7adbd1f566a394169385c73bd88bf60df7e759db8e08d"
+	expectedDigest := "e15b593c6ab8d7725a3cc82226ef816cac6bf9c70eed383bd459295cc65f5ec3"
 
 	// Call the function under test
 	artifact, err := digestLocalFileArtifact(artifactPath, "sha256")
diff --git a/pkg/cmd/attestation/test/data/github_release_artifact.zip b/pkg/cmd/attestation/test/data/github_release_artifact.zip
index 934302cd93449f12d999ab9fb7f4e28fb778bcf2..a4d222eb9e344b4038ce0a078f032f652aa823fe 100644
GIT binary patch
literal 169
zcmWIWW@h1H0D<bveNk0a`EQwlY!K#PkYPwHD#=VsOfCrx;bdUu6tv3V0^-sNZU#n{
zuZ#=~EFgUunOp(hj7)OOxQvkisbT;sXIRn*Vj&D=g&2xvV1PF(8%P}^5c&aWR}hB*
E0BSoMzW@LL

literal 797
zcmaKqL34sI6ol{micETKqEV|;5B)1n0*{zB@G>unGxpHmUab_+LQgP!yV;!$Ppl^V
zg!T{<xz--MOF-K1S)vR@5iwH<j2}}9alcqlHfIY>lt`BUgTsfF)}>=MvczU_d*!Uc
zg0YLAacGlE9-7ND3au*<e73IT&y0V)F(sFLS{XtwSxrlBS&!$<iwOb>ohz4+9$hmn
z-dz&YF*645Ojmm;XPU&M>pCI&I8g%HswgaB4s2h+2|R}Da-%(sj<DSfA)^5u{e~;4
zUi#4joqM_3j6Vx=29s?^*Yfoa62vk?2bJ9RkYa$cH>vdivcVFEi`%J3)UDa~SuIEX
pFaO-tE&@=E)abT^KmPmd&Bz^H6Fii78V(=gdnjNu(ogtx@^7uo@>&1@

diff --git a/pkg/cmd/attestation/test/data/github_release_artifact_invalid.zip b/pkg/cmd/attestation/test/data/github_release_artifact_invalid.zip
index 26b414dbce27d457432613f45174596f7d158eaf..fcdda88fe075d6013f3426d3f40603862d314360 100644
GIT binary patch
literal 188
zcmYdH3GilS;bH)R>dg21_eND!<pU{ZARmM|7-Sd{i%K%n5|c|pLpT|jIR&jUxPZ8{
zf}4Sn1*npdfq@02J0p`Tz?+dtjv1d}5+IcfKrIYFoj?TQA&h5*7>{9efHx}}NF^f>
M`T=QI5Ql*a02C=HfdBvi

literal 427
zcmaKmF%H5o3`O^x!U`)*3u6baQl->Q18E#N&Hw{v2dRjmYME@w@B6<4j7(3AT^9Dy
zb-@d=4J`;4R4P;9D}tUxQf}*-OaE{<XG84tpL4o9<Gf6zH&>eLWz{f{0{G-XV-zm|
z=g-WQwL_IcaX#uJ=+^~KrqSDEN<ZYhjVxX3fBP_FqRN)R3-LO&V{!9RZP)Asg73fD
TjoC5DV#iU4Lf(+TI4Jc7ZoZ5V

diff --git a/pkg/cmd/attestation/test/data/github_release_bundle.json b/pkg/cmd/attestation/test/data/github_release_bundle.json
index ae8dd1b56..8ca506dcb 100644
--- a/pkg/cmd/attestation/test/data/github_release_bundle.json
+++ b/pkg/cmd/attestation/test/data/github_release_bundle.json
@@ -4,7 +4,7 @@
     "timestampVerificationData": {
       "rfc3161Timestamps": [
         {
-          "signedTimestamp": "MIIC0TADAgEAMIICyAYJKoZIhvcNAQcCoIICuTCCArUCAQMxDTALBglghkgBZQMEAgIwgbwGCyqGSIb3DQEJEAEEoIGsBIGpMIGmAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgGvFc6nUuLhnXfhM9p0DV91c5kHvafP1hs9BX8KYeeSYCFQDhjGrIIiaH/jkMdN6HUsErnUfrlRgPMjAyNTA1MTMyMzAzNTFaMAMCAQGgNqQ0MDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIFRpbWVzdGFtcGluZ6AAMYIB3jCCAdoCAQEwSjAyMRUwEwYDVQQKEwxHaXRIdWIsIEluYy4xGTAXBgNVBAMTEFRTQSBpbnRlcm1lZGlhdGUCFB+7MIjE5/rL4XA4fNDnmXHA04+wMAsGCWCGSAFlAwQCAqCCAQUwGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNTA1MTMyMzAzNTFaMD8GCSqGSIb3DQEJBDEyBDDVh2oDCJy7ustugLKfVcUSNjo5M2MFMNKIU11sIQDCNOo5gbj9R97sCWXNnfmUztMwgYcGCyqGSIb3DQEJEAIvMXgwdjB0MHIEIHuISsKSyiJtlhGjT+RyS+tYQ7iwCMsMCTGmz2NK3D7DME4wNqQ0MDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIGludGVybWVkaWF0ZQIUH7swiMTn+svhcDh80OeZccDTj7AwCgYIKoZIzj0EAwMEZzBlAjAqp/fYVfQcU9aMcmTIZvb0cxk00OaVBYLzuiIvcRqkMdAJiz/gSxOWU0AQjEPskHUCMQCrUKlZR4shPZuMvY6CCUOhxxKq/6LUoccWNHyL6sGkHRXE7j9HETh4uLKzRwNDVVA="
+          "signedTimestamp": "MIIC0DADAgEAMIICxwYJKoZIhvcNAQcCoIICuDCCArQCAQMxDTALBglghkgBZQMEAgIwgbwGCyqGSIb3DQEJEAEEoIGsBIGpMIGmAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQg1c3kQQpo4Adf2E+nx78lNg8EjRSLpIRERpPF0HIavogCFQCOfZuxr0DOc1LsM+y+sjQCMFrtbxgPMjAyNTA1MzAyMDEzMzlaMAMCAQGgNqQ0MDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIFRpbWVzdGFtcGluZ6AAMYIB3TCCAdkCAQEwSjAyMRUwEwYDVQQKEwxHaXRIdWIsIEluYy4xGTAXBgNVBAMTEFRTQSBpbnRlcm1lZGlhdGUCFB+7MIjE5/rL4XA4fNDnmXHA04+wMAsGCWCGSAFlAwQCAqCCAQUwGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNTA1MzAyMDEzMzlaMD8GCSqGSIb3DQEJBDEyBDDkw1fXMZ6l/uWne+PcdzhLl2ckTZftcUuHcnYCwjhyYMeGOcgbpNNMDem46JCxItwwgYcGCyqGSIb3DQEJEAIvMXgwdjB0MHIEIHuISsKSyiJtlhGjT+RyS+tYQ7iwCMsMCTGmz2NK3D7DME4wNqQ0MDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIGludGVybWVkaWF0ZQIUH7swiMTn+svhcDh80OeZccDTj7AwCgYIKoZIzj0EAwMEZjBkAjBhE76zis18/xOtQdx6rJUuaRoZCflXHCjH6BqEk1B29r9C8STztZhAKalXL+Wy4rsCMFFaGPKF1uOl5JADiKMg5/7chJbWrfwyO9oa0tbmvcGrtBCdFeJ1Ic0tIi1sOVvq5Q=="
         }
       ]
     },
@@ -13,11 +13,11 @@
     }
   },
   "dsseEnvelope": {
-    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJ1cmkiOiJwa2c6Z2l0aHViL2JkZWhhbWVyL2RlbG1lQHY1IiwiZGlnZXN0Ijp7InNoYTEiOiJjNWUxN2E2MmUwNmExZDIwMTU3MDI0OWM2MWZhZTUzMWU5MjQ0ZTFiIn19LHsibmFtZSI6ImEuemlwIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImY3MTY1ODQ4ZjlmNWRkYzU3OGQ3YWRiZDFmNTY2YTM5NDE2OTM4NWM3M2JkODhiZjYwZGY3ZTc1OWRiOGUwOGQifX0seyJuYW1lIjoiYi56aXAiLCJkaWdlc3QiOnsic2hhMjU2IjoiOGI3ZWIxNTcyMzQ2NjkyZmZkM2FlMDEyNDhjNzBhMzQxYWUzYWE4YmUxZGY4YjEyMzQ2YjUwYWNiOTAwMjI4MiJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL2luLXRvdG8uaW8vYXR0ZXN0YXRpb24vcmVsZWFzZS92MC4xIiwicHJlZGljYXRlIjp7Im93bmVySWQiOiIzOTgwMjciLCJwdXJsIjoicGtnOmdpdGh1Yi9iZGVoYW1lci9kZWxtZUB2NSIsInJlbGVhc2VJZCI6IjIxODQxOTIxNyIsInJlcG9zaXRvcnkiOiJiZGVoYW1lci9kZWxtZSIsInJlcG9zaXRvcnlJZCI6IjkwNTk4ODA0NCIsInRhZyI6InY1In19",
+    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCAic3ViamVjdCI6W3sidXJpIjoicGtnOmdpdGh1Yi9iZGVoYW1lci9kZWxtZUB2NiIsICJkaWdlc3QiOnsic2hhMSI6ImM1ZTE3YTYyZTA2YTFkMjAxNTcwMjQ5YzYxZmFlNTMxZTkyNDRlMWIifX0sIHsibmFtZSI6ImFydGlmYWN0LnppcCIsICJkaWdlc3QiOnsic2hhMjU2IjoiZTE1YjU5M2M2YWI4ZDc3MjVhM2NjODIyMjZlZjgxNmNhYzZiZjljNzBlZWQzODNiZDQ1OTI5NWNjNjVmNWVjMyJ9fV0sICJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9pbi10b3RvLmlvL2F0dGVzdGF0aW9uL3JlbGVhc2UvdjAuMSIsICJwcmVkaWNhdGUiOnsib3duZXJJZCI6IjM5ODAyNyIsICJwdXJsIjoicGtnOmdpdGh1Yi9iZGVoYW1lci9kZWxtZUB2NiIsICJyZWxlYXNlSWQiOiIyMjIxNTg2NzEiLCAicmVwb3NpdG9yeSI6ImJkZWhhbWVyL2RlbG1lIiwgInJlcG9zaXRvcnlJZCI6IjkwNTk4ODA0NCIsICJ0YWciOiJ2NiJ9fQ==",
     "payloadType": "application/vnd.in-toto+json",
     "signatures": [
       {
-        "sig": "MEQCIH6LDUanQYOCPovZlIqI1cE49SiGJdexR65qsAZHohsZAiA9w3usgPWtgn5voB8bRvpJQtjEVqC5eMDh3mJEdyMcXw=="
+        "sig": "MEUCIGq+T2g2gV2+lcmgyCaVPrjO1tj86RxitwiEOjU5dH/GAiEAvKaT/7H0sIVdAY7EzLq1IFaF8LmlW6eV68eZQvtuA0c="
       }
     ]
   }
diff --git a/pkg/cmd/release/verify-asset/verify-asset_test.go b/pkg/cmd/release/verify-asset/verify-asset_test.go
index c732bfd86..0976807b1 100644
--- a/pkg/cmd/release/verify-asset/verify-asset_test.go
+++ b/pkg/cmd/release/verify-asset/verify-asset_test.go
@@ -33,13 +33,13 @@ func TestNewCmdVerifyAsset_Args(t *testing.T) {
 			name:     "valid args",
 			args:     []string{"v1.2.3", "../../attestation/test/data/github_release_artifact.zip"},
 			wantTag:  "v1.2.3",
-			wantFile: "../../attestation/test/data/github_release_artifact.zip",
+			wantFile: test.NormalizeRelativePath("../../attestation/test/data/github_release_artifact.zip"),
 		},
 		{
 			name: "valid flag with no tag",
 
 			args:     []string{"../../attestation/test/data/github_release_artifact.zip"},
-			wantFile: "../../attestation/test/data/github_release_artifact.zip",
+			wantFile: test.NormalizeRelativePath("../../attestation/test/data/github_release_artifact.zip"),
 		},
 		{
 			name:    "no args",
@@ -96,7 +96,7 @@ func TestNewCmdVerifyAsset_Args(t *testing.T) {
 
 func Test_verifyAssetRun_Success(t *testing.T) {
 	ios, _, _, _ := iostreams.Test()
-	tagName := "v5"
+	tagName := "v6"
 
 	fakeHTTP := &httpmock.Registry{}
 	defer fakeHTTP.Verify(t)
@@ -128,7 +128,7 @@ func Test_verifyAssetRun_Success(t *testing.T) {
 	require.NoError(t, err)
 }
 
-func Test_verifyAssetRun_Failed_With_Wrong_tag(t *testing.T) {
+func Test_verifyAssetRun_Failed_With_Invalid_tag(t *testing.T) {
 	ios, _, _, _ := iostreams.Test()
 	tagName := "v1"
 
@@ -164,7 +164,7 @@ func Test_verifyAssetRun_Failed_With_Wrong_tag(t *testing.T) {
 
 func Test_verifyAssetRun_Failed_With_Invalid_Artifact(t *testing.T) {
 	ios, _, _, _ := iostreams.Test()
-	tagName := "v5"
+	tagName := "v6"
 
 	fakeHTTP := &httpmock.Registry{}
 	defer fakeHTTP.Verify(t)
diff --git a/pkg/cmd/release/verify/verify_test.go b/pkg/cmd/release/verify/verify_test.go
index 22eaba54a..9668a71ff 100644
--- a/pkg/cmd/release/verify/verify_test.go
+++ b/pkg/cmd/release/verify/verify_test.go
@@ -79,7 +79,7 @@ func TestNewCmdVerify_Args(t *testing.T) {
 
 func Test_verifyRun_Success(t *testing.T) {
 	ios, _, _, _ := iostreams.Test()
-	tagName := "v5"
+	tagName := "v6"
 
 	fakeHTTP := &httpmock.Registry{}
 	defer fakeHTTP.Verify(t)